hxxp://youtube[.]com

Resubmissions

30/01/2025, 19:26

250130-x5yyfssmen 10

30/01/2025, 19:24

250130-x4cntssmcj 10

30/01/2025, 19:20

250130-x2afpaslfq 10

30/01/2025, 19:16

250130-xy5sesslcj 10

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2025, 19:16

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://youtube.com

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
173	raw.githubusercontent.com
174	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "30"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3836	msedge.exe
3836	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe
4936	msedge.exe
4936	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3420	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3420	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
948	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 4360	3836	msedge.exe	83
PID 3836 wrote to memory of 4360	3836	msedge.exe	83
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3824	3836	msedge.exe	85
PID 3836 wrote to memory of 3872	3836	msedge.exe	86
PID 3836 wrote to memory of 3872	3836	msedge.exe	86
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87
PID 3836 wrote to memory of 3608	3836	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb56146f8,0x7ffeb5614708,0x7ffeb5614718
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x344 0x3c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:400

C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3348

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3904855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0504c0d0b9c007a767de8a404f2ec484

SHA1
73b1066ce283079341bc94a3e5c65535f0523145

SHA256
3469f4679beea250ce59f3fa4721e48f81587735f44e0fa2b70638b78dbf8a2d

SHA512
c6c0c6edbaab3b92832c4140916e99ca6725b79e5d3a43ad59ebd94a567458ef79923e2236b43344ecb6fd75442d0c7779b024edbd1bf9035a2a86ba7e5ce606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
50236cd957789ed0d1b6564c7f0ecfae

SHA1
4c9e4dac57ab9ffb5bc55154d6ff89f1e6c1d5f4

SHA256
5820467c07d06249a1462b7c9deeb0801a8a6475ea19637397b9bbbc95f90fcd

SHA512
1cbf4be5224fecf811bf81361d6d282810de016194b17e2002d510287d384048272215b813838912eebcdddb1f657ade0aa3c122871c9d636b6a8fa8e74535d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
244KB

MD5
56bcfc292f5b13f996bcd9e3894f8e9e

SHA1
ef6491aeb70e32284da1b9704a9073e9bfc8b6ca

SHA256
f9872892acf766ffef419d57e033927850e47ff2d1bd111d0ffd353aebc5f20e

SHA512
385f337347b9db945795d7e5bbd84c1de99d7263926edf495c78e461371ca21732f9e693a6040af303ee4369624514b9a0568c86ee6c5e0808ef7c5517cbc300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
50KB

MD5
94c3ea98765b412bf4585cbc355d5997

SHA1
00380137bd61e483736cbd65a572416eae27fdd0

SHA256
ce0e240e9d9f299402957d4d1b151f88e0f3198b70e1af0e6ac37a5468283a6a

SHA512
89f8d581a00b1222763595c93d4434730dc5c2f373761d41790da4b5e560c2ef9ee269c776aac31681efadf1255cb97ef1457436879d56c2efc4cfb0cbab494f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
642KB

MD5
6a0242fad8beb19a8f7f401526c2c2c9

SHA1
728f2d94db56f5d1d0b3f6d73e8575063e0458ec

SHA256
9412856a8a91eaf15ec2f2c39414648d5f4cc802b13951ab3263aa32a6e9b167

SHA512
4c22a1cb942930624f7186efda56fa1283ceb0c71d6b363f763d1db2fcd076de55f3d545ad324706e552c4c1262a0f3a96735e7b8cac69a6f229afbee7b3c87f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
34KB

MD5
8223ae0c770c27b5159ffc75b0c9df86

SHA1
bc92f204ffff2324c2957182972fa52e1cc5ed61

SHA256
161e3d149cfa0feb2e4a06d225e60cb9392b4a0ec36c32483726bd5a2b9e6218

SHA512
e55e207d16fe3fe5ded504fdb21a6be93a92bbff682ae077fdd8163f6980084485b2cd6ea19000665fcf7d96fab0f29c66d014fca7da51fe61faba8f08ccb437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
34KB

MD5
e8832cfa464db3890c20cf33cd386185

SHA1
b2bb98c0b5a7914d638c39aa78fbe40ffa28e9a9

SHA256
6dddcd79a257c087acc58a12cb689cd1274f08900d7d91d7a27e5efe8bb02097

SHA512
73a63d2c74bc5ccbd5efe848bd0e3b77aad15ffa05dc52aec94fb3860a14b612c2e348c9145d814ec90bacea5ca013efe9e10fab15fd680f9b4bb353ea7feddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
20KB

MD5
125a6fddddc610a54a39ac8913fc1667

SHA1
bb252bae3bf7432329956d4c3be0bbc34c3126be

SHA256
ffb47a81f0910bea45ff1fec7527523f625870ed20e895dcc711a7dc6095cfe3

SHA512
a04153f5ce517774c6ffc6a6f7c23b46000e40d8fdeec8ee92f2d88bbf9268863d449ddf1321da4460350bd7f2143cc255b948368960336c27ff847fffb6c9c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
20KB

MD5
4fa02ac6347763639aeb01d8adf287b2

SHA1
8cbf6b37f0cd329ba5b4f4f59437c55dd3057b37

SHA256
ec23a39504c8b289a6401723dd1a5153e9072e5f5beca20f88fac54ed3a477d9

SHA512
371e4b42152c578090254323dd4846df1ab38ac6bcff8ed6b67143dbfa5111c72e64366ac24b6ac04f3c405ce22e5f50f2a04e1805cce8b22ee8b95139a53afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
22eb4813b267ccbd6c84542108e53ce2

SHA1
5b09e98eb8898ffdb2d9942cf06ece8965040f78

SHA256
31bfd535df1970efe6583d4342df2588fabb1d6de29b8c2b3477935cf76f3441

SHA512
8d4c156a14a4ab51c1a69ce22730b314e967bc22982426242d771650ead7c2753179b0b52da8627e5c990eb4e13843c0c48a0fee5b2f1c291cde50e15e1ddb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
71e3bc71d94b66fcd12499b06c063c9f

SHA1
f06332fab577e892ed259f2e3968ca86d523c824

SHA256
4fd2a948525c1333d83c3abaaff4f3e29b048e371ae6afdc579ca3bf517033eb

SHA512
c20000c00281b3f072c9a619ab5b733752247129e2b19aee5755263b0713efc744a536ec884ca7d622c1f4f9e7335f80222ad70b37e4276a9be841aa4e9d51c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e8df3fd327fe975d5a17febcd1280685

SHA1
5d558826b54c4857bb858ac3980ca6899d12d8d1

SHA256
f3d0f8e3249b665a64f59598693149b89105827c707f29afc98584c9e7d3062c

SHA512
453e3561876721ded58f5233200c964345712a7c9be8fa624ca004dbd2c8415ec98cf09d45e5dbde2e6c071c60c3583433a03aba5f17395ab11bda77228240cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc9429f597948399779c86eb199930a1

SHA1
deab7b64c14c8bcc0e277f69f3467d1fca492d79

SHA256
8f5ce891196fc2b77f97cdb30f936b18b5df91a95423ea4b1b32255d6df4bc37

SHA512
83a806f67d4e9f70f2bbf6bce7cf2ab08abf2ddf32f659b25e48ffcbe6d2ebb67a73a345249a5426ef8cbd37655960213bc8e75e6a293fde41f4e31415b1bd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
72781b9f112ffd10e09ae19cefcc7845

SHA1
abb98d5a87116c3280492af00ab23e9cd294092d

SHA256
38eb7799352e95dbc619b9742a7af55e311e85271748476353c55799fc8dc22d

SHA512
6fd12ba3df47bd91847a02da2833460b0abe1fbaffb71d37300ca85d70a11e12304ce2e6e9b2822cccb0f3c15602dadb8e576142a9ab4772ca4a5e4f9b77b33f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb24bedc391895776c60ba470e30776c

SHA1
e8485b045399d2d692cf1f0a3b02497761134ead

SHA256
cc3b23cd5c39787d12db09259f950adbfaa3611618da1179a4ae93f4dc47e55c

SHA512
214f1baf5ca30254dc0c7d718025d4d5686efc705e808860df32374680fd34bd6a6df0a0c22c531802bb7813424ed07451e5cb6cffbc13e6c4f442af4c83c89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
20c8bbb5e611e3d7c4da3bcebff339cd

SHA1
074a79f513af8204989329dd74017ccb5cb2b803

SHA256
31eea0531ade8cbca678de865d9bfcc0893148b9835666bbcbffdd240eea0762

SHA512
168afef46e2bf2023d392b919bfc313166666e6939e181a9469612c82f59b3cd3a08a3f8f015ec91591f9c48c0c98aec8620d64d8aab139c0c61ef3157cc5909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
82ecc4ebf8720dac14ba14012e666d5b

SHA1
9b6dd3ee0ce284379e416e07c95385f026d2cb12

SHA256
1681700e0a684d3ac9e952c5e07e62c65b18d7270e9e419bf5a38c9313559797

SHA512
2190d3f88481ea17f9c2c0673f4dbf96fdeb0f7d097e7af30f5e76451a4802166c6ac8523234be09cfdd230ae22992630240962b2a614756090acd69c75c3fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
99871810c8f306de002762a79b7feca3

SHA1
2aec5e2640402d8f8cca2dec1a23077a1f5fbe9c

SHA256
24bedbb58d49870be8120ae3c67edc54bd81494a6ddcb55305195f97e614da64

SHA512
55b0aaf7e7aaaa24233c3ef3707463b8a5d796e469575d03c681fcc463053464f6ce5020fd50f288594f1eabef0d018141cc116079621d8c445e2a652339fbcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8c3a3bba-b355-402c-a9a7-a831455da40a\index-dir\the-real-index

Filesize
624B

MD5
40d4fde4d62146db7150b3f9a20a16cd

SHA1
99c8019a8b8103a059b2eff6719e07c83746f5aa

SHA256
5bf7ffb2c3bbae5625c0c71d8079ebcf417bb975ed9eb036586be177174301da

SHA512
d5ccf4fff8844f390a148b8d01407c1b4737dd10efb5ed79cfbd59d4845757c3c3e84982eebecff4e0551647f49c74a4072fad062d443a843b9734e49b9d2051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8c3a3bba-b355-402c-a9a7-a831455da40a\index-dir\the-real-index~RFe57ff8e.TMP

Filesize
48B

MD5
80eae2d2d3ada69ddc2ddf013471f0a2

SHA1
c30e16675bd38efb6a456dec13655a77a42c253d

SHA256
0b0c74c34191d418b83170c40ca4273274edac05839a2565715a5657044aeecf

SHA512
a5fe87d206172fc43dd714fbcd2863255dfbe4b6a62c343348cc88427c0721be34ed73bb5e10bd88a8ed5028b1b57847191323cbf918bd0aa1619e97a4771240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\acff6f46-423b-4634-bffe-ec1407165b78\index-dir\the-real-index

Filesize
2KB

MD5
2f88db433f1377592c46c7e3cd43e542

SHA1
dc124a8b735ec13833f68191e2968b2212cddb34

SHA256
6ba6463d612a852e747173c4a54d744b4927a09c09070ec4fb7a5069948e2b49

SHA512
4d90f9541061225dfe2259f634c0522f11d6821d30806102e1cce961574a482a56600bd6c3fd42a1723f3ded52d0d3d994d5bdf1521db015f1a2597f1f597366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\acff6f46-423b-4634-bffe-ec1407165b78\index-dir\the-real-index~RFe57a604.TMP

Filesize
48B

MD5
993be6faa90dcd4fdc1b3d132447f829

SHA1
440523567c9930e2b6cf0010137c530604260ad4

SHA256
b2706ffa899d2b42361c5ec83e18f961b415238ddd3c1e2b7439d29a2891e961

SHA512
257ba8349edd89504cb2cb5bf29382d238024f39cc896b2c5396ce9cfb5cd07d773411c5a09fc1a7e03f47926b8755b1c0a6aa86f81ab6a0ec24d67385281b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\de44a369-2d3a-4d55-b575-6f9bfd503b0b\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
2f83109f14a1cb371ebf9ad3ecd60f91

SHA1
72ab718b5235e1f18aefcdd174a677c4902a1e0d

SHA256
756fb2107a565eac012094fa2240eab1c586a54bc59478d4451fa81b86df1e69

SHA512
aa743e6e1cf6bef509a1c44419b7cbd68259378e77dd8b6f31fb581a904422b3985669f6df26da4c6a781fd8a0220c95a46cbc32ac9d00783260d40b0533cd49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
d5278598a587c007dd493d6c99f51b8a

SHA1
83354eca4afe024ad2b063148ec3c30d9aaf3777

SHA256
4c90d080931e847a9c99482894f11c13740a51e83dbea1a141e8c3af81e39574

SHA512
00d862161a4735990039d45e86daacbe568a139b6c6d7e5546f35a87167131e5191bed558e5d9e5d5e91c0030c242a77ee269dc3bd77a7ccc0cb30e4c1d9bd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
0e80c7cd429fbacf22ea26e0abef6911

SHA1
198967177a2a770a65a0eda993e663811ea48111

SHA256
8ae4e57217a5a9eaed0f8fac01b9b1838f8ed7135327f28ce27bb6a428344f37

SHA512
865bad312145ef12200cb3daa7a9eaddc73142c74f833b24e56226a2e38e1420f8e7fa25f58188e86823afa8a946c3da4b16a773afffdde5d4c6cf1615a31dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
e117b4401b6ef72620f0aa6203e9ae77

SHA1
4ab375c802eb57a27bc5bcc1848b492834218a51

SHA256
c04a3fcecada3f9babb937bde7340a0736037e832ea9839af25dba251a8212ab

SHA512
3a00539b4651a7f21cce781f47e0e62147b5c063cd79d186c9ca349ef085a6a3ad123be5496158a92abd45a307c3c6069d4f33f7ea20af21b58e65e7bddbf9c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
cad391ca57624f2ca751c63f6c1bf0ef

SHA1
29a3983ac24c03b895319427ffe3c3866453864f

SHA256
8b2720b47262a9839a274e8b7722315f8be81252947a3ffe5cec8a4ed7bbf35c

SHA512
939a05596f8f2cfdf4716c6cf5c4d1da6b4dbd78c1a5c1ce27d010d471a897a8181168c84799a70d2c4b2462f493b40444745202924f5f920fd4d81160c0d3e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
64b15e144981181dac33af4f7242b5e1

SHA1
47112db51b080eaf531a1db80ed39122ed6d0d9b

SHA256
dc7266dff3f6b9d4bd58f9fac8e01f69eb483708bd598ea2dde860cc1b14a97a

SHA512
6919c53627efc9c04f97e0bb6e220d2f3560b872741c3de27e9c04af8d803df283b6a4b540dda0903fb3a38b7072dc7c23b2e51adeb59bcf35057faf7581cf50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
c78c2775ee3ddee808f4bafd5c4f7ead

SHA1
ce5b7368872aae773c079013222b04b405e4149a

SHA256
144ff2072e587645b606314edf5cac2c4c5c14b6feb6fd61b01679a6bbf4ced6

SHA512
2c8486fe8290af655ba687bf2f91904240d5567864f61ddeb6b1d48eae12024ed762a7c6f8bc720a2720391a82001223db90c69d75cdb4bf498f9240462b6624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
8b2dc273ebcdabd1559e9aa31081dd00

SHA1
03a7baa297213c1258cdcde1c105cb0bb952d462

SHA256
44abcc70b4bce52dc79ae0045a41883b886f3300d0b77c8ed3739f452841af76

SHA512
0fe9b78bf7532c58da671fe13316c9b2f96d2d52045abe4d945b0bacf3520f2da8945b0840072e36ed676ad6a896a3a31d7dafbd5ca986c1e4b7b69e9332b865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f8c7.TMP

Filesize
48B

MD5
f5943e1734d176cb00cc62e34d83b1c6

SHA1
c6db3f34115c9dec2118e6cc8fd5f6ddb3bd434c

SHA256
677e16741a65d81dbf681a219409616df8166c635447ebc0aa9343f79a38c7db

SHA512
dae4e193abe40b7f2c3333de12936d8016c6fcfdd039d7db43f1945e632daae94eba8cf9e114a13130fc074244badc8af0de2c72d0132769fbfb9bf50bdf5f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2b1b16c3710d4e879d4cd46899d5bcf9

SHA1
e54b77b0d9eaeacbd3f957f551098f6ab7070bda

SHA256
81bd274f5f1364a4224b347568fd84fd8cc284fef444798da3ac249d554eadf5

SHA512
4b7d18abbbb7c46a6563b88eb7f69a7b2ebdfa72282e754f83a862e72d5a0ab2d5955cacd7f971f74df27812409f0ec0f9cb71efcf5cf232ff4ee115520e345a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
24c47d2924e9190a1fb5d0da36221cd2

SHA1
aba91218a613ffee968360b513c744fee2294a93

SHA256
77ca2723c5a379c85e2fad0c758bbfa536d685fe28b4c64732f772ab81ceacab

SHA512
36e8c2396c09f415f9fda33bb2ba4d6d3ad6f9a3044d2925261d39e7b142ed6e7fcc8419cd0a243a383536301e37f5f73f8012ba77af00b3027caf25fabbbdde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e8ff91aacb73690b8c51e1c1b2581c08

SHA1
81be9e77c82d152d5a19523ce96a2fc15823c4ab

SHA256
f5c3e5538395350aa94b5c3ec51ad747febb246d0b1ea30eea47dc58fa20af33

SHA512
32745bca465229846608c3e8a49a71a27095e6711f9dfaa2b793bbcebd1d0e3789b303146569720a67f653bdc2265abded253a1c8f1fa55e5650e088672aca03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e5bb87c7643a11e6a3c70dcd95696b4d

SHA1
1b6e7fa7ed2b8b8f217d2ba07689d71fb1d071cb

SHA256
49d588a6fa4456698b28a66220b4c0b09b5ef0fb24370749a0322623d58d370d

SHA512
466c4f51ee92ee6fe8b747af75ca37e460f96180051a9f7aa3f08f827229ae48ca36244c247d657e6bf93918664fa549f53331d51cc5e0b2f8b00bbbde6ee988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
69dea0f02f1dda625a585de37945fc8e

SHA1
0686ed4c5fb5f7f0a961f85aa9a3bddc1ade99ca

SHA256
79233a59e50e56086b6175a8532ccd5f958532ab9d43dde084371c4a7699767b

SHA512
7a52074e47807776801f51c3ec0d1bc26e2c0ad5d8b69e2fc4764884d0550b2edbf27fa6168e639b179b5f24f70d37690942d18b596829f70ea3e3f2a73684b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b68995a8a8ed0262a15756db7fbbfde4

SHA1
7047e0bcc441d269b8b0cad661e38cb0565233b5

SHA256
7fcc1b72042620d381f5a807bc858c8d4c106e282ad6390089007bdf36069760

SHA512
234cc5305781c3b431941db53ed68e4f5cfc9168d3d44a2e47793c9375073cbe9a40c4773a99618d1794b7f7e3c470375a58c69610e691e0471975b9487a2841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f155.TMP

Filesize
706B

MD5
7144ddca439931c5d3b4bfc8208fcb02

SHA1
84db014c3b8bd2a9971cc25c2605c7d92e7db883

SHA256
e2217832c922d80eda3ee2e5b68f486688f45f9de2b1b8462cd5bede9d6df47c

SHA512
96ef51ea35e6bf4c710e7eaa156f5af4322cfbb84e6c1d952e0508d575f0163560c3b87295511fe442816306199ecbfd42d0a6b1ac6a901fa27517dbeee4d551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ba411618a19fab8e0e49baf74438bae

SHA1
a0ab4b719d76310833993d73e5975d5bbb0b141c

SHA256
2e9a9de65513fc50256eb7460f98d2368139fdf3fb4a9868bd03993b113606a6

SHA512
23a1b7ce813c36918680821374b58fc27abd9fd1c761181cabaf8e0d5a9f1454e9b2b0330c723dc28d95cb4797b1f02d63006e039c9d71a1f04322de18c9ff1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8fe1f72f7ce53fe496783a26dbe0a09

SHA1
8fb0ee413e4185285f0ee4ccd7574c56e1351b14

SHA256
c9a90b16f54f54cdf4be3d901777fbd2758013de42caffb7158ecd250d2714a9

SHA512
bf4d5b556f978e989cff787f4602864fbad8ba7257d39d478f78b4955f291779d84947faed743f717c2ede9f78e72233e665a93db19f1d4cc8da76bde8505098

Download Submit
C:\Users\Admin\Downloads\NoEscape.zip

Filesize
616KB

MD5
ef4fdf65fc90bfda8d1d2ae6d20aff60

SHA1
9431227836440c78f12bfb2cb3247d59f4d4640b

SHA256
47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

SHA512
6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

Download Submit
C:\Users\Public\Desktop\ᬏ↑⃾ܼ⡊ᏊὙ␆⹭ᣣ⠱๷مὖ⟢ᩴⵔ⪏⽔⾫ବՁᴚഝᏛրಐ

Filesize
666B

MD5
e49f0a8effa6380b4518a8064f6d240b

SHA1
ba62ffe370e186b7f980922067ac68613521bd51

SHA256
8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

SHA512
de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

Download Submit
memory/3348-1281-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/3348-1458-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads